wallet: allow signing a message with spend or view key

src/cryptonote_config.h

@@ -230,6 +230,7 @@ namespace config
   const unsigned char HASH_KEY_CLSAG_ROUND[] = "CLSAG_round";
   const unsigned char HASH_KEY_CLSAG_AGG_0[] = "CLSAG_agg_0";
   const unsigned char HASH_KEY_CLSAG_AGG_1[] = "CLSAG_agg_1";
+  const char HASH_KEY_MESSAGE_SIGNING[] = "MessageSignature";
 
   namespace testnet
   {

src/device/device.hpp

@@ -162,6 +162,7 @@ namespace hw {
         virtual std::vector<crypto::public_key>  get_subaddress_spend_public_keys(const cryptonote::account_keys &keys, uint32_t account, uint32_t begin, uint32_t end) = 0;
         virtual cryptonote::account_public_address  get_subaddress(const cryptonote::account_keys& keys, const cryptonote::subaddress_index &index) = 0;
         virtual crypto::secret_key  get_subaddress_secret_key(const crypto::secret_key &sec, const cryptonote::subaddress_index &index) = 0;
+        virtual crypto::secret_key  get_subaddress_view_secret_key(const crypto::secret_key &sec, const cryptonote::subaddress_index &index) = 0;
 
         /* ======================================================================= */
         /*                            DERIVATION & KEY                             */

src/device/device_default.cpp

@@ -207,6 +207,12 @@ namespace hw {
             return m;
         }
 
+        crypto::secret_key  device_default::get_subaddress_view_secret_key(const crypto::secret_key &a, const cryptonote::subaddress_index &index) {
+            crypto::secret_key skey = get_subaddress_secret_key(a, index);
+            sc_mul((unsigned char*)skey.data, (const unsigned char*)skey.data, (const unsigned char*)a.data);
+            return skey;
+        }
+
         /* ======================================================================= */
         /*                            DERIVATION & KEY                             */
         /* ======================================================================= */

src/device/device_default.hpp

@@ -85,6 +85,7 @@ namespace hw {
             std::vector<crypto::public_key>  get_subaddress_spend_public_keys(const cryptonote::account_keys &keys, uint32_t account, uint32_t begin, uint32_t end) override;
             cryptonote::account_public_address  get_subaddress(const cryptonote::account_keys& keys, const cryptonote::subaddress_index &index) override;
             crypto::secret_key  get_subaddress_secret_key(const crypto::secret_key &sec, const cryptonote::subaddress_index &index) override;
+            crypto::secret_key  get_subaddress_view_secret_key(const crypto::secret_key &sec, const cryptonote::subaddress_index &index) override;
 
             /* ======================================================================= */
             /*                            DERIVATION & KEY                             */

src/device/device_ledger.cpp

@@ -880,6 +880,12 @@ namespace hw {
         return sub_sec;
     }
 
+    crypto::secret_key  device_ledger::get_subaddress_view_secret_key(const crypto::secret_key &sec, const cryptonote::subaddress_index &index) {
+#warning TODO
+        MERROR("Not implemented yet");
+        return crypto::null_skey;
+    }
+
     /* ======================================================================= */
     /*                            DERIVATION & KEY                             */
     /* ======================================================================= */

src/device/device_ledger.hpp

@@ -249,6 +249,7 @@ namespace hw {
         std::vector<crypto::public_key>  get_subaddress_spend_public_keys(const cryptonote::account_keys &keys, uint32_t account, uint32_t begin, uint32_t end) override;
         cryptonote::account_public_address  get_subaddress(const cryptonote::account_keys& keys, const cryptonote::subaddress_index &index) override;
         crypto::secret_key  get_subaddress_secret_key(const crypto::secret_key &sec, const cryptonote::subaddress_index &index) override;
+        crypto::secret_key  get_subaddress_view_secret_key(const crypto::secret_key &sec, const cryptonote::subaddress_index &index) override;
 
         /* ======================================================================= */
         /*                            DERIVATION & KEY                             */

src/simplewallet/simplewallet.cpp

@@ -223,7 +223,7 @@ namespace
   const char* USAGE_GET_TX_NOTE("get_tx_note <txid>");
   const char* USAGE_GET_DESCRIPTION("get_description");
   const char* USAGE_SET_DESCRIPTION("set_description [free text note]");
-  const char* USAGE_SIGN("sign [<account_index>,<address_index>] <filename>");
+  const char* USAGE_SIGN("sign [<account_index>,<address_index>] [--spend|--view|--both] <filename>");
   const char* USAGE_VERIFY("verify <filename> <address> <signature>");
   const char* USAGE_EXPORT_KEY_IMAGES("export_key_images [all] <filename>");
   const char* USAGE_IMPORT_KEY_IMAGES("import_key_images <filename>");
@@ -9877,7 +9877,7 @@ bool simple_wallet::sign(const std::vector<std::string> &args)
     fail_msg_writer() << tr("command not supported by HW wallet");
     return true;
   }
-  if (args.size() != 1 && args.size() != 2)
+  if (args.size() != 1 && args.size() != 2 && args.size() != 3)
   {
     PRINT_USAGE(USAGE_SIGN);
     return true;
@@ -9893,17 +9893,33 @@ bool simple_wallet::sign(const std::vector<std::string> &args)
     return true;
   }
 
+  tools::wallet2::message_signature_type_t message_signature_type = tools::wallet2::sign_with_spend_key;
   subaddress_index index{0, 0};
-  if (args.size() == 2)
+  for (unsigned int idx = 0; idx + 1 < args.size(); ++idx)
   {
     unsigned int a, b;
-    if (sscanf(args[0].c_str(), "%u,%u", &a, &b) != 2)
+    if (sscanf(args[idx].c_str(), "%u,%u", &a, &b) == 2)
     {
-      fail_msg_writer() << tr("Invalid subaddress index format");
+      index.major = a;
+      index.minor = b;
+    }
+    else if (args[idx] == "--spend")
+    {
+      message_signature_type = tools::wallet2::sign_with_spend_key;
+    }
+    else if (args[idx] == "--view")
+    {
+      message_signature_type = tools::wallet2::sign_with_view_key;
+    }
+    else if (args[idx] == "--both")
+    {
+      message_signature_type = tools::wallet2::sign_with_both_keys;
+    }
+    else
+    {
+      fail_msg_writer() << tr("Invalid subaddress index format, and not a signature type: ") << args[idx];
       return true;
     }
-    index.major = a;
-    index.minor = b;
   }
 
   const std::string &filename = args.back();
@@ -9917,7 +9933,7 @@ bool simple_wallet::sign(const std::vector<std::string> &args)
 
   SCOPED_WALLET_UNLOCK();
 
-  std::string signature = m_wallet->sign(data, index);
+  std::string signature = m_wallet->sign(data, message_signature_type, index);
   success_msg_writer() << signature;
   return true;
 }
@@ -9948,14 +9964,14 @@ bool simple_wallet::verify(const std::vector<std::string> &args)
     return true;
   }
 
-  r = m_wallet->verify(data, info.address, signature);
+  tools::wallet2::message_signature_result_t result = m_wallet->verify(data, info.address, signature);
-  if (!r)
+  if (!result.valid)
   {
     fail_msg_writer() << tr("Bad signature from ") << address_string;
   }
   else
   {
-    success_msg_writer() << tr("Good signature from ") << address_string;
+    success_msg_writer() << tr("Good signature from ") << address_string << (result.old ? " (using old signature algorithm)" : "") << " with " << (result.type == tools::wallet2::sign_with_spend_key ? "spend key" : result.type == tools::wallet2::sign_with_view_key ? "view key" : result.type == tools::wallet2::sign_with_both_keys ? "both spend and view keys" : "unknown key combination (suspicious)");
   }
   return true;
 }

src/wallet/api/wallet.cpp

@@ -1998,7 +1998,7 @@ bool WalletImpl::checkReserveProof(const std::string &address, const std::string
 
 std::string WalletImpl::signMessage(const std::string &message)
 {
-  return m_wallet->sign(message);
+  return m_wallet->sign(message, tools::wallet2::sign_with_spend_key);
 }
 
 bool WalletImpl::verifySignedMessage(const std::string &message, const std::string &address, const std::string &signature) const
@@ -2008,7 +2008,7 @@ bool WalletImpl::verifySignedMessage(const std::string &message, const std::stri
   if (!cryptonote::get_account_address_from_str(info, m_wallet->nettype(), address))
     return false;
 
-  return m_wallet->verify(message, info.address, signature);
+  return m_wallet->verify(message, info.address, signature).valid;
 }
 
 std::string WalletImpl::signMultisigParticipant(const std::string &message) const

src/wallet/wallet2.cpp

@@ -12207,51 +12207,114 @@ void wallet2::set_account_tag_description(const std::string& tag, const std::str
   m_account_tags.first[tag] = description;
 }
 
-std::string wallet2::sign(const std::string &data, cryptonote::subaddress_index index) const
+static crypto::hash get_message_hash(const std::string &data)
 {
+  KECCAK_CTX ctx;
+  keccak_init(&ctx);
+  keccak_update(&ctx, (const uint8_t*)config::HASH_KEY_MESSAGE_SIGNING, sizeof(config::HASH_KEY_MESSAGE_SIGNING)); // includes NUL
+  char len_buf[(sizeof(size_t) * 8 + 6) / 7];
+  char *ptr = len_buf;
+  tools::write_varint(ptr, data.size());
+  CHECK_AND_ASSERT_THROW_MES(ptr > len_buf && ptr <= len_buf + sizeof(len_buf), "Length overflow");
+  keccak_update(&ctx, (const uint8_t*)len_buf, ptr - len_buf);
+  keccak_update(&ctx, (const uint8_t*)data.data(), data.size());
   crypto::hash hash;
-  crypto::cn_fast_hash(data.data(), data.size(), hash);
+  keccak_finish(&ctx, (uint8_t*)&hash);
+  return hash;
+}
+
+std::string wallet2::sign(const std::string &data, message_signature_type_t signature_type, cryptonote::subaddress_index index) const
+{
+  const crypto::hash hash = get_message_hash(data);
   const cryptonote::account_keys &keys = m_account.get_keys();
   crypto::signature signature;
-  crypto::secret_key skey;
+  crypto::secret_key skey, m;
   crypto::public_key pkey;
   if (index.is_zero())
   {
-    skey = keys.m_spend_secret_key;
+    switch (signature_type)
-    pkey = keys.m_account_address.m_spend_public_key;
+    {
+      case sign_with_spend_key:
+        skey = keys.m_spend_secret_key;
+        pkey = keys.m_account_address.m_spend_public_key;
+        break;
+      case sign_with_view_key:
+        skey = keys.m_view_secret_key;
+        pkey = keys.m_account_address.m_view_public_key;
+        break;
+#if 0
+      case sign_with_both_keys:
+#endif
+      default: CHECK_AND_ASSERT_THROW_MES(false, "Invalid signature type requested");
+    }
   }
   else
   {
-    skey = keys.m_spend_secret_key;
+    switch (signature_type)
-    crypto::secret_key m = m_account.get_device().get_subaddress_secret_key(keys.m_view_secret_key, index);
+    {
-    sc_add((unsigned char*)&skey, (unsigned char*)&m, (unsigned char*)&skey);
+      case sign_with_spend_key:
+        skey = keys.m_spend_secret_key;
+        m = m_account.get_device().get_subaddress_secret_key(keys.m_view_secret_key, index);
+        sc_add((unsigned char*)&skey, (unsigned char*)&m, (unsigned char*)&skey);
+        break;
+      case sign_with_view_key:
+        skey = keys.m_spend_secret_key;
+        m = m_account.get_device().get_subaddress_secret_key(keys.m_view_secret_key, index);
+        sc_add((unsigned char*)&skey, (unsigned char*)&m, (unsigned char*)&skey);
+        sc_mul((unsigned char*)&skey, (unsigned char*)&keys.m_view_secret_key, (unsigned char*)&skey);
+        break;
+#if 0
+      case sign_with_both_keys: skey = ...; break;
+#endif
+      default: CHECK_AND_ASSERT_THROW_MES(false, "Invalid signature type requested");
+    }
     secret_key_to_public_key(skey, pkey);
   }
   crypto::generate_signature(hash, pkey, skey, signature);
-  return std::string("SigV1") + tools::base58::encode(std::string((const char *)&signature, sizeof(signature)));
+  return std::string("SigV2") + tools::base58::encode(std::string((const char *)&signature, sizeof(signature)));
 }
 
-bool wallet2::verify(const std::string &data, const cryptonote::account_public_address &address, const std::string &signature) const
+tools::wallet2::message_signature_result_t wallet2::verify(const std::string &data, const cryptonote::account_public_address &address, const std::string &signature) const
 {
-  const size_t header_len = strlen("SigV1");
+  static const size_t v1_header_len = strlen("SigV1");
-  if (signature.size() < header_len || signature.substr(0, header_len) != "SigV1") {
+  static const size_t v2_header_len = strlen("SigV2");
+  const bool v1 = signature.size() >= v1_header_len && signature.substr(0, v1_header_len) == "SigV1";
+  const bool v2 = signature.size() >= v2_header_len && signature.substr(0, v2_header_len) == "SigV2";
+  if (!v1 && !v2)
+  {
     LOG_PRINT_L0("Signature header check error");
-    return false;
+    return {};
   }
   crypto::hash hash;
-  crypto::cn_fast_hash(data.data(), data.size(), hash);
+  if (v1)
+  {
+    crypto::cn_fast_hash(data.data(), data.size(), hash);
+  }
+  else
+  {
+    hash = get_message_hash(data);
+  }
   std::string decoded;
-  if (!tools::base58::decode(signature.substr(header_len), decoded)) {
+  if (!tools::base58::decode(signature.substr(v1 ? v1_header_len : v2_header_len), decoded)) {
     LOG_PRINT_L0("Signature decoding error");
-    return false;
+    return {};
   }
   crypto::signature s;
   if (sizeof(s) != decoded.size()) {
     LOG_PRINT_L0("Signature decoding error");
-    return false;
+    return {};
   }
   memcpy(&s, decoded.data(), sizeof(s));
-  return crypto::check_signature(hash, address.m_spend_public_key, s);
+  if (crypto::check_signature(hash, address.m_spend_public_key, s))
+    return {true, v1 ? 1u : 2u, !v2, sign_with_spend_key };
+  if (crypto::check_signature(hash, address.m_view_public_key, s))
+    return {true, v1 ? 1u : 2u, !v2, sign_with_view_key };
+#if 0
+  rct::key both = ...;
+  if (crypto::check_signature(hash, rct::rct2pk(both), s))
+    return {true, v1 ? 1u : 2u, !v2, sign_with_both_keys };
+#endif
+  return {};
 }
 
 std::string wallet2::sign_multisig_participant(const std::string& data) const

src/wallet/wallet2.h

@@ -1341,8 +1341,10 @@ private:
      */
     void set_account_tag_description(const std::string& tag, const std::string& description);
 
-    std::string sign(const std::string &data, cryptonote::subaddress_index index = {0, 0}) const;
+    enum message_signature_type_t { sign_with_spend_key, sign_with_view_key, sign_with_both_keys };
-    bool verify(const std::string &data, const cryptonote::account_public_address &address, const std::string &signature) const;
+    std::string sign(const std::string &data, message_signature_type_t signature_type, cryptonote::subaddress_index index = {0, 0}) const;
+    struct message_signature_result_t { bool valid; unsigned version; bool old; message_signature_type_t type; };
+    message_signature_result_t verify(const std::string &data, const cryptonote::account_public_address &address, const std::string &signature) const;
 
     /*!
      * \brief sign_multisig_participant signs given message with the multisig public signer key

src/wallet/wallet_rpc_server.cpp

@@ -2007,7 +2007,20 @@ namespace tools
       return false;
     }
 
-    res.signature = m_wallet->sign(req.data, {req.account_index, req.address_index});
+    tools::wallet2::message_signature_type_t signature_type = tools::wallet2::sign_with_spend_key;
+    if (req.signature_type == "spend" || req.signature_type == "")
+      signature_type = tools::wallet2::sign_with_spend_key;
+    else if (req.signature_type == "view")
+      signature_type = tools::wallet2::sign_with_view_key;
+    else if (req.signature_type == "both")
+      signature_type = tools::wallet2::sign_with_both_keys;
+    else
+    {
+      er.code = WALLET_RPC_ERROR_CODE_INVALID_SIGNATURE_TYPE;
+      er.message = "Invalid signature type requested";
+      return false;
+    }
+    res.signature = m_wallet->sign(req.data, signature_type, {req.account_index, req.address_index});
     return true;
   }
   //------------------------------------------------------------------------------------------------------------------------------
@@ -2042,7 +2055,17 @@ namespace tools
       return false;
     }
 
-    res.good = m_wallet->verify(req.data, info.address, req.signature);
+    const auto result = m_wallet->verify(req.data, info.address, req.signature);
+    res.good = result.valid;
+    res.version = result.version;
+    res.old = result.old;
+    switch (result.type)
+    {
+      case tools::wallet2::sign_with_spend_key: res.signature_type = "spend"; break;
+      case tools::wallet2::sign_with_view_key: res.signature_type = "view"; break;
+      case tools::wallet2::sign_with_both_keys: res.signature_type = "both"; break;
+      default: res.signature_type = "invalid"; break;
+    }
     return true;
   }
   //------------------------------------------------------------------------------------------------------------------------------

src/wallet/wallet_rpc_server_commands_defs.h

@@ -1618,11 +1618,13 @@ namespace wallet_rpc
       std::string data;
       uint32_t account_index;
       uint32_t address_index;
+      std::string signature_type;
 
       BEGIN_KV_SERIALIZE_MAP()
         KV_SERIALIZE(data)
         KV_SERIALIZE_OPT(account_index, 0u)
         KV_SERIALIZE_OPT(address_index, 0u)
+        KV_SERIALIZE(signature_type)
       END_KV_SERIALIZE_MAP()
     };
     typedef epee::misc_utils::struct_init<request_t> request;
@@ -1657,9 +1659,15 @@ namespace wallet_rpc
     struct response_t
     {
       bool good;
+      unsigned version;
+      bool old;
+      std::string signature_type;
 
       BEGIN_KV_SERIALIZE_MAP()
         KV_SERIALIZE(good);
+        KV_SERIALIZE(version);
+        KV_SERIALIZE(old);
+        KV_SERIALIZE(signature_type);
       END_KV_SERIALIZE_MAP()
     };
     typedef epee::misc_utils::struct_init<response_t> response;

src/wallet/wallet_rpc_server_error_codes.h

@@ -76,3 +76,4 @@
 #define WALLET_RPC_ERROR_CODE_NON_DETERMINISTIC      -43
 #define WALLET_RPC_ERROR_CODE_INVALID_LOG_LEVEL      -44
 #define WALLET_RPC_ERROR_CODE_ATTRIBUTE_NOT_FOUND    -45
+#define WALLET_RPC_ERROR_CODE_INVALID_SIGNATURE_TYPE -47

tests/functional_tests/sign_message.py

@@ -43,8 +43,10 @@ from framework.wallet import Wallet
 class MessageSigningTest():
     def run_test(self):
       self.create()
-      self.check_signing(False)
+      self.check_signing(False, False)
-      self.check_signing(True)
+      self.check_signing(False, True)
+      self.check_signing(True, False)
+      self.check_signing(True, True)
 
     def create(self):
         print('Creating wallets')
@@ -66,8 +68,8 @@ class MessageSigningTest():
             assert res.address == self.address[i]
             assert res.seed == seeds[i]
 
-    def check_signing(self, subaddress):
+    def check_signing(self, subaddress, spend_key):
-        print('Signing/verifing messages with ' + ('subaddress' if subaddress else 'standard address'))
+        print('Signing/verifing messages with ' + ('subaddress' if subaddress else 'standard address') + ' ' + ('spend key' if spend_key else 'view key'))
         messages = ['foo', '']
         if subaddress:
             address = []
@@ -84,11 +86,14 @@ class MessageSigningTest():
             account_index = 0
             address_index = 0
         for message in messages:
-            res = self.wallet[0].sign(message, account_index = account_index, address_index = address_index)
+            res = self.wallet[0].sign(message, account_index = account_index, address_index = address_index, signature_type = 'spend' if spend_key else 'view')
             signature = res.signature
             for i in range(2):
                 res = self.wallet[i].verify(message, address[0], signature)
                 assert res.good
+                assert not res.old
+                assert res.version == 2
+                assert res.signature_type == 'spend' if spend_key else 'view'
                 res = self.wallet[i].verify('different', address[0], signature)
                 assert not res.good
                 res = self.wallet[i].verify(message, address[1], signature)

tests/fuzz/signature.cpp

@@ -59,6 +59,6 @@ BEGIN_INIT_SIMPLE_FUZZER()
 END_INIT_SIMPLE_FUZZER()
 
 BEGIN_SIMPLE_FUZZER()
-  bool valid = wallet->verify("test", address, std::string((const char*)buf, len));
+  tools::wallet2::message_signature_result_t result = wallet->verify("test", address, s);
-  std::cout << "Signature " << (valid ? "valid" : "invalid") << std::endl;
+  std::cout << "Signature " << (result.valid ? "valid" : "invalid") << std::endl;
 END_SIMPLE_FUZZER()

utils/python-rpc/framework/wallet.py

@@ -706,13 +706,14 @@ class Wallet(object):
         }
         return self.rpc.send_json_rpc_request(check_reserve_proof)
 
-    def sign(self, data, account_index = 0, address_index = 0):
+    def sign(self, data, account_index = 0, address_index = 0, signature_type = ""):
         sign = {
             'method': 'sign',
             'params' : {
                 'data': data,
                 'account_index': account_index,
                 'address_index': address_index,
+                'signature_type': signature_type,
             },
             'jsonrpc': '2.0', 
             'id': '0'